CVE-2021-30860highunder attackCWE-190

CVE-2021-30860: high-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor macOS+ Monitor iOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 76%
from disclosure to weapon25 days
Published on NVDAug 24
1st PoC+25d
CISA KEV+71d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in how Apple's PDF reader handles certain numbers can cause it to crash or run malicious code. This happens when you open a specially crafted PDF file, and attackers may have already been using this to harm users.

Technical detail

An integer overflow vulnerability in Apple's PDF processing (CWE-190) allows remote code execution through a maliciously crafted PDF. The attack requires no user authentication beyond opening the file, and the issue affects iOS, macOS, and watchOS platforms. Exploitation has been observed in active attacks in the wild.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. Processing a maliciously crafted PDF may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iOSApple · macOSApple · watchOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30657MEDIUMCVE-2021-30657EPSS 68.5%KEVCVE-2025-43300CRITICALCVE-2025-43300EPSS 65.2%KEVCVE-2023-32434HIGHCVE-2023-32434EPSS 58.2%KEVCVE-2023-41064HIGHCVE-2023-41064EPSS 53.4%KEVCVE-2021-30807HIGHCVE-2021-30807EPSS 28.8%KEVCVE-2023-28205HIGHCVE-2023-28205EPSS 27.1%KEV